Similarly, most of the CI tools require huge number of permissions, including Travis.

GH has OAuth scoping, but it needs to be more fine-grained. Say, configurable to per-repository level.